Our takeCISA reports active exploitation in Eclipse Milo <=1.1.4: attackers can delete protected data, recover credentials, impersonate users, or crash the server. Update past 1.1.4 now if you run it.Security Resilience desk
Sources (3)
- cisa_advisories · cisa_advisories
- cisa_ics · cisa_ics
- auscert_bulletins · auscert_bulletins
What this means for you — Security leader:Update all Eclipse Milo deployments to 1.1.5 or later immediately; these CVEs allow credential recovery, data deletion, impersonation, and DoS.
What this means for you — Lean IT orgs:If you run Eclipse Milo (often embedded in industrial or building systems), update it to version 1.1.5 or newer as soon as possible.
What this means for you — MSP:Audit client environments for Eclipse Milo >=0.6.0 and <=1.1.4; patch to 1.1.5+ and verify no exposed OPC UA endpoints remain.
What this means for you — Researcher:CISA reports active exploitation of CVE-2026-63252, CVE-2026-63248 and CVE-2026-60007 in Eclipse Milo <=1.1.4.